#!/bin/bash

# This is a script to automate the joining to AD
# Released under Apache License 2.0
# Written by Nathan Adams (adamsna@datanethost.net)

# ****WARNING****
# This does have the potential to bork your system!
# When in doubt test on a dummy system first!
#
# Tested for the following systems:
# Debian 6.0
#
# Version 1.0 8/1/2012
#  - Initial Version
# Version 1.1 10/14/2012
#  - Adding some variables I missed in V1.0

echo "ADJ - Written by Nathan Adams"
echo "I understand this can break my system:"
select yn in "Yes" "No"; do
    case $yn in
		Yes ) break;;
        No ) exit;;
    esac
done

#based off of http://ubuntuforums.org/showthread.php?t=91510
#install pre-reqs
apt-get -qq install krb5-user
apt-get -qq install winbind samba

read -p "Enter full domain (ex corp.com): " domain
read -p "Enter DNS of a domain controller (ex dc.corp.com): " dc
read -p "Enter user to join with (ex Administrator): " user
read -p "Enter OU: " ou

domain_upper=`echo $domain | tr '[:lower:]' '[:upper:]'`
short_domain=`echo $domain | sed 's/\..*//'`
short_domain_upper=`echo $short_domain | tr '[:lower:]' '[:upper:]'`
hostname_upper=`hostname | tr '[:lower:]' '[:upper:]'`
dc_upper=`echo $dc | tr '[:lower:]' '[:upper:]'`


krb5_conf="
[logging]
    default = FILE10000:/var/log/krb5lib.log

[libdefaults]
        default_realm = <domain_upper>

        krb4_config = /etc/krb.conf
        krb4_realms = /etc/krb.realms
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        ticket_lifetime = 24000

[realms]
   <dc_upper> = {
        kdc = <dc>
        admin_server = <dc>
        default_domain = <domain_upper>
}


[domain_realm]
    .<domain> = <domain_upper>
    <domain> = <domain_upper>
"

smb_config="
[global]
        security = ads
        netbios name = <hostname>
        realm = <domain_upper>
        password server = <dc>
        workgroup = <short_domain>
        idmap uid = 500-10000000
        idmap gid = 500-10000000
        winbind separator = ^
        winbind enum users = no
        winbind enum groups = no
        winbind use default domain = yes
        winbind cache time = 15
        idmap cache time = 15
        idmap negative cache time = 15
        template homedir = /home/%D/%U
        template shell = /bin/bash
        client use spnego = yes
        domain master = no
        winbind enum users = yes
        winbind enum groups = yes
        winbind offline logon = true
        winbind refresh tickets = true
"

nsswitch_config="# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the 'glibc-doc-reference' and 'info' packages installed, try:
# 'info libc \"Name Service Switch\"' for information about this file.

passwd:         compat winbind
group:          compat winbind
shadow:         compat

hosts:          files dns wins
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis
"


# Backup and remove config files
if [ -f /etc/krb5.conf ]
then
	cp /etc/krb5.conf /etc/krb5.conf.`date "+%Y%m%d_%H%M%S"`
	rm /etc/krb5.conf
fi

if [ -f /etc/samba/smb.conf ]
then
	cp /etc/samba/smb.conf /etc/samba/smb.conf.`date "+%Y%m%d_%H%M%S"`
	rm /etc/samba/smb.conf
fi

if [ -f /etc/nsswitch.conf ]
then
	cp /etc/nsswitch.conf /etc/nsswitch.conf.`date "+%Y%m%d_%H%M%S"`
fi

# Create home directory
if [ ! -d /home/$short_domain_upper ]
then
	mkdir /home/$short_domain_upper
fi

if [ -f /etc/pam.d/common-session ]
then
	cp /etc/pam.d/common-session /etc/pam.d/common-session.`date "+%Y%m%d_%H%M%S"`
fi

krb5_conf=${krb5_conf//<domain>/$domain}
krb5_conf=${krb5_conf//<domain_upper>/$domain_upper}
krb5_conf=${krb5_conf//<dc>/$dc}
krb5_conf=${krb5_conf//<dc_upper>/$dc_upper}

echo "$krb5_conf" > /etc/krb5.conf

smb_config=${smb_config//<hostname>/$hostname_upper}
smb_config=${smb_config//<dc>/$dc}
smb_config=${smb_config//<domain_upper>/$domain_upper}
smb_config=${smb_config//<short_domain>/$short_domain}

echo "$smb_config" > /etc/samba/smb.conf

# setup nsswitch
#ns_file=`cat /etc/nsswitch.conf`

#passwd_str=`grep "passwd:         compat winbind" /etc/nsswitch.conf`
#group_str=`grep "group:         compat winbind" /etc/nsswitch.conf`
#hosts_str=`grep "hosts:          files dns wins" /etc/nsswitch.conf`

#if [ "$passwd_str" = "" ]
#then
#	ns_file=${ns_file/passwd:         compat/passwd:         compat winbind}
#fi

#if [ "$group_str" = "" ]
#then
#	ns_file=${ns_file/group:          compat/group:         compat winbind}
#fi

#if [ "$hosts_str" = "" ]
#then
#	ns_file=${ns_file/hosts:          files dns/hosts:          files dns wins}
#fi

#echo "$ns_file" > /etc/nsswitch.conf

echo "$nsswitch_config" > /etc/nsswitch.conf

# I don't think this is necessary
# pam-auth-update --package winbind

net ads join -U$user $ou

os=`cat /etc/issue`

smbscript=""
if [[ "$os" == *Debian* ]]
then
	$smbscript stop
elif [[ "$os" == *Ubuntu* ]]
then
	service smbd stop
fi

/etc/init.d/winbind stop

if [[ "$os" == *Debian* ]]
then
	$smbscript start
elif [[ "$os" == *Ubuntu* ]]
then
	service smbd start
fi

/etc/init.d/winbind start

pam_file=`cat /etc/pam.d/common-session`
mkhomedir_str=`grep pam_mkhomedir /etc/pam.d/common-session`

if [ "$mkhomedir_str" = "" ]
then
	pam_file=${pam_file/\# end of pam-auth-update config/\# end of pam-auth-update config
session     required      /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0077}
fi

echo "$pam_file" > /etc/pam.d/common-session